Traditional ransomware dynamic detection methods need to collect software behaviors for a long time

which is difficult to meet the need for timely detection of ransomware. From the perspective of the timely detection of ransomware

this article proposes a concept named "Critical Time Periods for Ransomware Detection (CTP)"

and proposes an early ransomware detection method based on short application programming interface (API) sequence (REDMS) to fit the requirement of CTP. REDMS takes the short API sequences that are obtained by software running during the CTP as the analysis o

bject

and calculates these short API sequences through the

n

-gram model and the term frequency-inverse document frequency algorithm to generate the feature vectors

and then uses a machine-learning algorithm to build a detection model for detecting ransomware. The experimental results show that when the first 7 seconds of API collection period and random forest algorithm are used

REDMS achieves 98.2% and 96.7% accuracy respectively for detecting the known and unknown ransomware samples.